Your AI Agent Just Made a Decision. Who's Accountable?

Responsible Agentic AI

Key Takeaways

80% of organizations have encountered risky behavior from AI agents — taking unintended actions, misusing tools, or operating beyond guardrails. (McKinsey, 2026)

Three frameworks are converging to address this: Singapore’s MGF for Agentic AI, NIST’s AI Agent Standards Initiative, and the Cloud Security Alliance’s Agentic Trust Framework. Each tackles a different angle. Most enterprises haven’t adopted any of them.

My take: Responsible AI used to mean “don’t say something offensive.” With agents, it means “don’t do something dangerous.” That’s a different beast entirely — and it needs governance to match.

The Problem Changed

I have recently read the article by McKinsey’s Rich Isenberg and it stuck with me: “Agency isn’t a feature — it’s a transfer of decision rights. The question shifts from ‘Is the model accurate?’ to ‘Who is accountable when the system acts?’”

That’s the shift. With chatbots and copilots, the worst case was bad advice. With agents, the worst case is bad action — an unauthorized transaction, a data breach, a decision that violates regulation. And some companies without proper guardrail have faced this issue.

McKinsey’s March 2026 report on AI trust puts it bluntly: organizations can no longer worry only about AI saying the wrong thing. They have to worry about AI doing the wrong thing.

Three Frameworks Worth Knowing

The good news: serious people are working on this. Three frameworks emerged in early 2026, each from a different angle. None is perfect alone. Together, they cover the ground.

	Singapore MGF	NIST AI Agent Standards	CSA Agentic Trust
Focus	Governance & accountability	Identity & interoperability	Security & zero trust
Core question	How do we govern agents?	How do we make agents governable?	How do we secure agents?
Launched	Jan 2026 (WEF)	Feb 17, 2026	Feb 2, 2026
Scope	Full lifecycle governance	Technical standards	Security controls
Maturity	Voluntary framework	Standards initiative	Specification
Best for	Policy & compliance teams	Platform & infra teams	Security teams
ASEAN relevance	High — regional norm-setter	Medium — US-centric	High — vendor-adopted

Singapore’s Model AI Governance Framework for Agentic AI

Launched at WEF in January 2026 by IMDA — the world’s first governance framework specifically for agentic AI.

Four dimensions:

Assess and bound risks upfront — evaluate system linkages, data sensitivity, autonomy level, and cascading effects before deployment
Meaningful human accountability — clear allocation of responsibilities and approval checkpoints. Humans remain ultimately accountable.
Technical controls — sandboxing, safety testing, monitoring, protection against misuse or privilege escalation
End-user responsibility — users understand what the agent can and can’t do

It’s voluntary. But Singapore has a track record of turning soft governance into regional norms. If you operate in ASEAN, this is your starting point.

NIST AI Agent Standards Initiative

AI Agent Governance Frameworks

Launched February 17, 2026 by NIST’s Center for AI Standards and Innovation. This extends the existing NIST AI Risk Management Framework to agentic scenarios.

The focus: how agents identify themselves, communicate with other systems, and operate securely. Think of it as the identity and interoperability layer — the plumbing that makes multi-agent systems auditable.

If Singapore’s framework answers “how do we govern agents?”, NIST answers “how do we make agents governable at a technical level?”

Cloud Security Alliance Agentic Trust Framework

Published February 2, 2026. The first specification applying Zero Trust principles to AI agents.

The core idea: never trust an agent by default. Every action requires verification. Every tool call needs authorization. Every data access gets audited. Same principles your security team applies to human users — now applied to AI.

At RSAC 2026, every major vendor echoed this. Microsoft’s Vasu Jakkal: “Zero Trust must extend to AI.” Cisco’s Jeetu Patel: “Move from access control to action control.” CrowdStrike’s George Kurtz called the governance gap around AI “the biggest in enterprise technology.”

What I’m Seeing on the Ground

I see a consistent pattern: teams deploy agents fast and govern them later. This isn’t unique. Across the five ASEAN markets I work in, the gap between agent deployment speed and governance readiness is widening. Singapore is ahead — the MGF gives organizations a starting point. But for the rest of ASEANs, most enterprises are flying blind. They have agents in production with no formal decision-rights mapping, no audit trail for agent actions, and no clear accountability chain when something goes wrong. The cost of waiting is real.

What I’d Do Next Morning

If you’re running AI agents in production — or about to — here’s where to start:

Map your agents’ decision rights. What can each agent do? What data can it access? What actions can it take? Most teams I work with can’t answer this. That’s the first gap to close.

Pick a framework and start. Singapore’s MGF if you need governance structure. CSA’s ATF if you need security controls. NIST if you need interoperability standards. You don’t need all three on day one. You need one.

Treat agents like employees, not software. They need onboarding, permissions, supervision, and performance reviews. The organizations getting this right are the ones that stopped thinking of agents as code and started thinking of them as team members with limited authority.

If this was useful, share it with your AI governance team. And if you’re navigating agentic AI in your enterprise, I’d love to hear what’s working — and what isn’t. Connect with me on LinkedIn or subscribe to the newsletter for more.